Cyber Risk Management: 5 Important Considerations

Cyber risk is pretty much omnipresent these days, which makes creating a cyber risk management strategy daunting for many organizations.

Indeed, there is no single cyber risk management approach that will stop all cyber crime; it varies per industry. But generally speaking, there are five elements that are common in successful cyber risk management:

1.) Start with a proper cybersecurity framework, which provides a structure for ensuring your “CIA”

• Confidentiality of sensitive data – restricting access to who can view the data
• Integrity of the systems – controlling who can write or change or delete data
• Availability – ensuring that systems are up and running when they are needed

There are a number of cybersecurity frameworks readily available; the most relevant to audiovisual systems contractors are the ISO/IEC Security Control Standards, the FCC Cyber Security Planning Guide, and the NIST (National Institute of Standards and Technology) Cybersecurity Framework, which has been widely adopted across many industries.

2.) Implement a balanced distribution of responsibility

Many users think that cybersecurity is the responsibility of the IT department, but it is really everyone’s responsibility. Anyone with email access can be susceptible to a “phishing” scam where they inadvertently click a malicious link or attachment.

Executives must understand the risks and their responsibilities.

Related: 6 Essential Steps for Your Data Breach Incident Response Plan

3.) Take a ‘holistic approach’ to security

Consider not only technical factors, but human and physical factors.

It is important that companies equip their employees with the right tools to recognize phishing email and malware, or even bad actors within their organization. Develop a company culture of cyber-awareness, and provide adequate training to all users.

Reward users for raising security concerns. Minimize physical access to equipment using access controls.

4.) Develop a thorough and ongoing risk assessment process

The first step is to identify and categorize your assets, including digital assets and intellectual property (IP).

Next, identify the threats to your organization, which could be external, like a hacker locking up your systems using ransom ware, or someone stealing credit card or personal informational, or a hacktivist who doesn’t agree with your company’s values.

Watch: 9 Cyber Security Training Videos That Are Actually Pretty Funny

Maybe a competitor wants to shut you down for a week and ruin your reputation?

But there could also be internal threats: users who might accidentally delete files, or malicious employees who try to steal your trade secrets. Assume you just hired the next Edward Snowden.

Consider a third party who can test and assess your systems and vulnerabilities. Like humans, most companies cannot recognize their own faults.

5.) Last but not least: Develop an Incident Response Plan & Incident Response Team

Everyone in the organization needs to know what to do when a threat has been detected. We talked about Incident Response Plans in greater detail last month, see this link to that article.

By developing and maintaining a cyber risk management approach for technicians, you can minimize the cyber threats and resulting impacts to your organization. You will also be prepared when your clients ask you for a copy of your cybersecurity policy or risk mitigation plan (and they will!)

The original version of this article appears on sister site Commercial Integrator.

Paul Konikowski, CTS-D, is an independent freelance consultant who currently designs and coordinates audiovisual installations for military bases. Paul earned his Bachelor of Science in Computer Engineering from the Georgia Institute of Technology (Georgia Tech). He has recently completed Harvard University’s online shortcourse entitled “Cybersecurity: Managing Risk in The Information Age”, and is now pursuing a Master of Science degree in Cybersecurity at Georgia Tech. He can be reached via Twitter at @PKaudiovisual or via email [email protected].

If you enjoyed this article and want to receive more valuable industry content like this, click here to sign up for our digital newsletters!